Re: Help in clearing out /var/spool/mqueue

As Viktor said, /var/spool/mqueue is the mail queue directory. If those mails were going to your local users, sendmail would quickly move them to /var/mail/ - so these mails are probably addressed to somewhere else.

Run "mailq | more" to see some basic address and subject information about each message in the queue.

If you can determine all the messages in the mail queue are junk or obsolete, you can delete the entire mail queue - just make sure the Sendmail daemon is stopped before doing that.

1.) You may have an old and forgotten cron job that runs rather frequently. It used to run without no errors at all, producing no output. But now some change has caused it to produce error messages, and the cron daemon is trying to mail those errors to the owner of the job (or whoever else has been configured to receive the errors from that cron job).

2.) If TCP port 25 of your system is reachable from the internet and your system allows mail relaying for anyone (known as "open relay"), a spammer might be exploiting your system. If your mailq output indicates that about >95% of the messages are for recipients outside your organization and subjects include "h3rbal v1agra" or are otherwise identifiable as junk mail, this is probably the case.

3.) If you have shut down your Sendmail daemon and the recipients in the mailq listing all seem legitimate, your site's mail server may have been unreachable.

Whenever you attempt to send mail from this system, the system makes _one_ attempt to deliver the mail to the destination immediately; if that attempt fails, the outgoing mail is placed into /var/spool/mqueue and the sendmail daemon is supposed to retry it until the retry time limit expires. But if your Sendmail daemon is disabled, nothing will take those delayed messages out of the queue - so the queue will keep accumulating forever, until the sysadmin notices something is wrong.

On HP-UX 11.23 and older, whenever you disable the Sendmail daemon, you should set up a periodic cron job that runs "sendmail -q" every 30 min or so; with this command, Sendmail will make one pass through the mail queue and will make attempts to deliver each message to their destination; or if the retry time limit has expired, it will delete the message from the queue and create a bounce message to the original sender.

On HP-UX 11.31, the procedure is different: if you don't want the system to receive email, but want to still send it, you should *not* completely disable the sendmail daemon; instead, you should set SENDMAIL_SENDONLY to 1 in /etc/rc.config.d/mailservs.

Re: Help in clearing out /var/spool/mqueue

Hi

I have identify the contents of those files, some say that there were errors delivering mail, and there will be no more attempts to deliver the mail. Some are headers, the others are ??Is there a procedure to delete those files?

Re: Help in clearing out /var/spool/mqueue

Hi

I beleive it was because, the mail relay server was down, I can see that now a simple sendmail test is working , and /var is decreasing slowly. If the mail relay server goes down again, could I just stop sendmail until the mail admin fix it, would that be a solution?

>>could I just stop sendmail until the mail admin fix it, would that be a solution?Yes, you can stop the sendmail service, but not, of course, the output queue generation. One of the reasons to be of a queue is store jobs for later delivery after the service restored. There are extreme solutions consisting rename command (sendmail, mailx, etc) that feed this queue. Personally I would not recommend this option, you better wait for your mail relay server is up again.

Re: Help in clearing out /var/spool/mqueue

Hi Jose!

I think email delivery is now working, because I did receive that test mail, although this messages>>(<201103100623.p2A6N9B16748@mcelbill.mcel.co.mz> Queued mail for delivery) says that perhaps mail has been put in a queue.And also /var is decreasing, is now at 85% from 100%.

Re: Help in clearing out /var/spool/mqueue

Hi,

Q-ID: *internal* identifier used on this host for the message.#man mailq

#mailq -v|wc -lThis provide you the number of lines in the output of "mailq -v" command.Try several times on reazonables intervals.If this value increases without decrease your delivery service is down. By other hand, if decreases the sendmail service is dispatching.

If you check /var/adm/syslog/mail.log you can follow the sendmail service activity. Here you can see info about queued filename (eg: QAA05864), destinatary address, relay server used and delivery status of outgoing mesagges.eg: stat=Sent (OK id=1Pxi42-00045Y-Ih).

You can follow this activity on real time by:#tail -f /var/adm/syslog/mail.log

Also you can see messages about dead.letter, this mean that sendmail service haven't way to delivery the message and create or append inside the source user homedir (eg: root, oracle) a plain text file named dead.letter, that contains the original message's header and body.